commit: 3bf93797179b43e8d97a66356a9bddefe44d1ccf
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Wed May 6 23:26:58 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Wed May 6 23:27:46 2015 +0000
URL: https://gitweb.gentoo.org/proj/hardened-dev.git/commit/?id=3bf93797
tboot: add pcid disable patch
.../tboot/files/tboot-1.8.2-disable-pcid.patch | 26 ++++++++++++++++++++++
sys-boot/tboot/tboot-1.8.2.ebuild | 9 ++++----
2 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch
b/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch
new file mode 100644
index 0000000..383338e
--- /dev/null
+++ b/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch
@@ -0,0 +1,26 @@
+diff -ur tboot-1.8.2.orig/tboot/common/shutdown.S
tboot-1.8.2/tboot/common/shutdown.S
+--- tboot-1.8.2.orig/tboot/common/shutdown.S 2014-07-28 12:24:22.000000000
+0400
++++ tboot-1.8.2/tboot/common/shutdown.S 2015-05-07 03:05:47.300985413
+0400
+@@ -34,6 +34,11 @@
+ */
+
+ compat_mode_entry:
++ /* Disable PCID */
++ movl %cr4, %eax
++ andl $~CR4_PCIDE, %eax
++ movl %eax, %cr4
++
+ /* Disable paging and therefore leave 64 bit mode. */
+ movl %cr0, %eax
+ andl $~CR0_PG, %eax
+diff -ur tboot-1.8.2.orig/tboot/include/processor.h
tboot-1.8.2/tboot/include/processor.h
+--- tboot-1.8.2.orig/tboot/include/processor.h 2014-07-28 12:24:22.000000000
+0400
++++ tboot-1.8.2/tboot/include/processor.h 2015-05-07 03:04:58.721244858
+0400
+@@ -92,6 +92,7 @@
+ #define CR4_XMM 0x00000400 /* enable SIMD/MMX2 to use except 16 */
+ #define CR4_VMXE 0x00002000/* enable VMX */
+ #define CR4_SMXE 0x00004000/* enable SMX */
++#define CR4_PCIDE 0x00020000/* enable PCID */
+
+ #ifndef __ASSEMBLY__
+
diff --git a/sys-boot/tboot/tboot-1.8.2.ebuild
b/sys-boot/tboot/tboot-1.8.2.ebuild
index 389c93c..bcfc004 100644
--- a/sys-boot/tboot/tboot-1.8.2.ebuild
+++ b/sys-boot/tboot/tboot-1.8.2.ebuild
@@ -26,10 +26,11 @@ sys-boot/grub:2"
DOCS=(README COPYING CHANGELOG)
src_prepare() {
- epatch "${FILESDIR}/${P}-genkernel_arch.patch"
- epatch "${FILESDIR}/${P}-stack-check-no.patch" # breaks with ssp
- sed -i 's/ -Werror//g' Config.mk
- sed -i 's/^INSTALL_STRIP = -s$//' Config.mk # QA Errors
+ epatch "${FILESDIR}/tboot-1.8.2-genkernel_arch.patch"
+ epatch "${FILESDIR}/tboot-1.8.2-stack-check-no.patch" # breaks with ssp
+ epatch "${FILESDIR}/tboot-1.8.2-disable-pcid.patch" # PaX enables pcid
+ sed -i 's/ -Werror//g' Config.mk || die
+ sed -i 's/^INSTALL_STRIP = -s$//' Config.mk || die # QA Errors
# the version number is wrong in the grub files
sed -i 's/tboot_version="1.8.1"/tboot_version="1.8.2"/'
tboot/20_linux*tboot
